MulmoClaude

Highlights

Push a collection back to Google Calendar (#2598)

A googleCalendar collection could only ever be filled from Google. There was no setting for a write-back — which is why a user trying to set up "two-way sync" could not find one, and why the conversation with the agent went in circles: the thing being looked for did not exist.

The collection view now has a Push to Google button beside Sync. It creates events for records you added locally and updates the fields you actually edited, leaving attendees, reminders and recurrence untouched. It deliberately never deletes — a Google delete removes the event for every attendee and cannot be undone — and it skips a record edited on both sides rather than picking a winner.

Push before you sync. A pull overwrites a locally edited record as soon as Google reports any change to that event, so syncing first can discard the edit that was waiting to go out.

Under it sits a per-calendar baseline holding the raw value Google last reported. The pull deliberately drops the zone offset and flattens all-day events to midnight, so a push cannot rebuild a Google time from the stored value alone — and the same baseline is the only way to tell a local edit from an untouched record. Writes are conditional on the version that was read, so a change landing in between is refused rather than silently overwritten.

Icons that rendered as their own names (#2605, #2606)

Both icon fonts resolve a glyph from the element's text via a ligature, so a name the font does not carry formed no ligature and the browser typeset the letters instead — invisible as an icon, but still taking the width. Six spinners and five schema-driven icons are fixed, with a static guard so the regression cannot return silently.

Security and robustness

The dev server no longer exposes your LAN by default (#2604); the CSRF guard now verifies the loopback premise it had only asserted in a comment (#2607); request-derived values reaching the log can no longer forge log lines (#2591); unchecked casts on externally supplied data are replaced with real runtime guards (#2592, #2594); and a polynomial ReDoS in the HTML attribute iterator is gone (CodeQL #402).

Faster sessions list (#2588, #2584)

The sessions scan re-read every session's meta sidecar on every pass — several hundred sessions is not unusual — and returning to a backgrounded tab did all of it twice. Both are fixed.

Self-service triage (#2571)

"Is this a bug?" now starts by trying to solve it: the symptom goes through one form, settings and documented behaviour are checked, then existing issues are searched — and something new is filed only if none of that explained it.

Note on 1.7.0

[email protected] went to npm twenty minutes before the icon fix merged, so it does not contain it. v1.7.0 is tagged at the exact tree that was packed, for traceability. Use 1.7.1.

Full Changelog

See CHANGELOG.md.